The Savscand process reaches 100% CPU following an IDE release on March 18th 22:54 (UTC)

Article ID:
120775

Updated:
25 Mar 2014

Issue

Following the release of the IDE named sshdoo-h.ide, the Sophos process savscand reaches 100% CPU usage on some computers. This IDE was released on March 18th 2014 at 22:54 UTC.

First seen in

Sophos Anti-Virus for Linux

Operating systems Linux

Cause

SophosLabs released an IDE which included an identity that caused some systems to experience high CPU loads. The identity caused the Sophos AV-engine to use more CPU cycles than normal when encountering certain file types, due to an error in the design of the identity.

Sophos Labs released an updated IDE inje-avq.ide at March 19th 2014 04:47 UTC, within four hours of the first customer reported incident.

What To Do

This issue was resolved with the release of inje-avq.ide on at March 19th 2014 04:47 UTC.